mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 21:41:09 +02:00
76d11a84ee
The JWT already carried a `tier` claim but nothing on the server read it
— AuthGate enforcement was client-only, so a valid JWT could hit paid
LLM/research endpoints regardless of the user's access tier.
- shared-hono authMiddleware now extracts `tier` into `c.userTier`,
defaulting unknown/missing claims to `public` (never silently grants
higher access).
- New `requireTier(minTier)` middleware + `hasTier`/`getTierLevel`
helpers. Tier hierarchy (guest < public < beta < alpha < founder) is
mirrored locally to avoid pulling the Svelte-facing shared-branding
package into Bun services.
- Applied `requireTier('beta')` as defense-in-depth on resource-heavy
apps/api modules (chat, context, food, guides, news-research, picture,
plants, research, traces, who) and the MCP endpoint. Pure CRUD modules
stay auth-only — access there is gated by ownership, not tier.
- DEV_BYPASS_AUTH now injects `userTier` (defaults to founder, override
via DEV_USER_TIER).
- Authentication guideline documents the pattern + test suite covers
hierarchy, passes-at-minimum, and rejection paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.9 KiB
TypeScript
47 lines
1.9 KiB
TypeScript
/**
|
|
* @mana/shared-hono — Shared infrastructure for Hono + Bun compute servers.
|
|
*
|
|
* Replaces NestJS boilerplate (Module, Controller, Guard, HealthModule, MetricsModule)
|
|
* with lightweight Hono equivalents.
|
|
*
|
|
* Usage:
|
|
* ```ts
|
|
* import { Hono } from 'hono';
|
|
* import { cors } from 'hono/cors';
|
|
* import { logger } from 'hono/logger';
|
|
* import { authMiddleware, serviceAuthMiddleware } from '@mana/shared-hono/auth';
|
|
* import { createDb } from '@mana/shared-hono/db';
|
|
* import { healthRoute } from '@mana/shared-hono/health';
|
|
* import { adminRoutes } from '@mana/shared-hono/admin';
|
|
* import { errorHandler, notFoundHandler } from '@mana/shared-hono/error';
|
|
*
|
|
* const app = new Hono();
|
|
* app.onError(errorHandler);
|
|
* app.notFound(notFoundHandler);
|
|
* app.use('*', logger());
|
|
* app.use('*', cors({ origin: process.env.CORS_ORIGINS?.split(',') ?? ['http://localhost:5173'] }));
|
|
*
|
|
* app.route('/health', healthRoute('my-server'));
|
|
* app.use('/api/*', authMiddleware());
|
|
* app.route('/api/v1/admin', adminRoutes(db, userTables));
|
|
*
|
|
* // App-specific compute routes
|
|
* app.route('/api/v1/compute', myRoutes);
|
|
*
|
|
* export default { port: Number(process.env.PORT ?? 3019), fetch: app.fetch };
|
|
* ```
|
|
*/
|
|
|
|
export { authMiddleware, serviceAuthMiddleware } from './auth';
|
|
export { requireTier, hasTier, getTierLevel } from './tier';
|
|
export { createDb } from './db';
|
|
export type { DbOptions } from './db';
|
|
export { healthRoute } from './health';
|
|
export { adminRoutes } from './admin';
|
|
export { errorHandler, notFoundHandler, serviceErrorHandler } from './error';
|
|
export { getBalance, validateCredits, consumeCredits, refundCredits } from './credits';
|
|
export type { CreditBalance, CreditValidationResult } from './credits';
|
|
export { rateLimitMiddleware } from './rate-limit';
|
|
export { requestLogger, initLogger } from './logger';
|
|
export { logger } from '@mana/shared-logger';
|
|
export type { CurrentUserData, AuthVariables, AccessTier } from './types';
|